1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
|
/*
* Copyright (c) 1995, 1996, 1997, 1998 Kungliga Tekniska Högskolan
* (Royal Institute of Technology, Stockholm, Sweden).
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* 3. Neither the name of the Institute nor the names of its contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/
#include "krb_locl.h"
RCSID("$Id: krb_get_in_tkt.c,v 1.30 1999/12/02 16:58:42 joda Exp $");
/*
* decrypt_tkt(): Given user, instance, realm, passwd, key_proc
* and the cipher text sent from the KDC, decrypt the cipher text
* using the key returned by key_proc.
*/
static int
decrypt_tkt(const char *user,
char *instance,
const char *realm,
const void *arg,
key_proc_t key_proc,
KTEXT *cip)
{
des_cblock key; /* Key for decrypting cipher */
int ret;
ret = key_proc(user, instance, realm, arg, &key);
if (ret != 0)
return ret;
encrypt_ktext(*cip, &key, DES_DECRYPT);
memset(&key, 0, sizeof(key));
return 0;
}
/*
* krb_get_in_tkt() gets a ticket for a given principal to use a given
* service and stores the returned ticket and session key for future
* use.
*
* The "user", "instance", and "realm" arguments give the identity of
* the client who will use the ticket. The "service" and "sinstance"
* arguments give the identity of the server that the client wishes
* to use. (The realm of the server is the same as the Kerberos server
* to whom the request is sent.) The "life" argument indicates the
* desired lifetime of the ticket; the "key_proc" argument is a pointer
* to the routine used for getting the client's private key to decrypt
* the reply from Kerberos. The "decrypt_proc" argument is a pointer
* to the routine used to decrypt the reply from Kerberos; and "arg"
* is an argument to be passed on to the "key_proc" routine.
*
* If all goes well, krb_get_in_tkt() returns INTK_OK, otherwise it
* returns an error code: If an AUTH_MSG_ERR_REPLY packet is returned
* by Kerberos, then the error code it contains is returned. Other
* error codes returned by this routine include INTK_PROT to indicate
* wrong protocol version, INTK_BADPW to indicate bad password (if
* decrypted ticket didn't make sense), INTK_ERR if the ticket was for
* the wrong server or the ticket store couldn't be initialized.
*
* The format of the message sent to Kerberos is as follows:
*
* Size Variable Field
* ---- -------- -----
*
* 1 byte KRB_PROT_VERSION protocol version number
* 1 byte AUTH_MSG_KDC_REQUEST | message type
* HOST_BYTE_ORDER local byte order in lsb
* string user client's name
* string instance client's instance
* string realm client's realm
* 4 bytes tlocal.tv_sec timestamp in seconds
* 1 byte life desired lifetime
* string service service's name
* string sinstance service's instance
*/
int
krb_mk_as_req(const char *user,
const char *instance,
const char *realm,
const char *service,
const char *sinstance,
int life,
KTEXT cip)
{
KTEXT_ST pkt_st;
KTEXT pkt = &pkt_st; /* Packet to KDC */
KTEXT_ST rpkt_st;
KTEXT rpkt = &rpkt_st; /* Reply from KDC */
int kerror;
struct timeval tv;
/* BUILD REQUEST PACKET */
unsigned char *p = pkt->dat;
int tmp;
size_t rem = sizeof(pkt->dat);
tmp = krb_put_int(KRB_PROT_VERSION, p, rem, 1);
if (tmp < 0)
return KFAILURE;
p += tmp;
rem -= tmp;
tmp = krb_put_int(AUTH_MSG_KDC_REQUEST, p, rem, 1);
if (tmp < 0)
return KFAILURE;
p += tmp;
rem -= tmp;
tmp = krb_put_nir(user, instance, realm, p, rem);
if (tmp < 0)
return KFAILURE;
p += tmp;
rem -= tmp;
gettimeofday(&tv, NULL);
tmp = krb_put_int(tv.tv_sec, p, rem, 4);
if (tmp < 0)
return KFAILURE;
p += tmp;
rem -= tmp;
tmp = krb_put_int(life, p, rem, 1);
if (tmp < 0)
return KFAILURE;
p += tmp;
rem -= tmp;
tmp = krb_put_nir(service, sinstance, NULL, p, rem);
if (tmp < 0)
return KFAILURE;
p += tmp;
rem -= tmp;
pkt->length = p - pkt->dat;
rpkt->length = 0;
/* SEND THE REQUEST AND RECEIVE THE RETURN PACKET */
kerror = send_to_kdc(pkt, rpkt, realm);
if(kerror) return kerror;
kerror = kdc_reply_cipher(rpkt, cip);
return kerror;
}
int
krb_decode_as_rep(const char *user,
char *instance,
const char *realm,
const char *service,
const char *sinstance,
key_proc_t key_proc,
decrypt_proc_t decrypt_proc,
const void *arg,
KTEXT as_rep,
CREDENTIALS *cred)
{
int kerror;
time_t now;
if (decrypt_proc == NULL)
decrypt_tkt(user, instance, realm, arg, key_proc, &as_rep);
else
(*decrypt_proc)(user, instance, realm, arg, key_proc, &as_rep);
kerror = kdc_reply_cred(as_rep, cred);
if(kerror != KSUCCESS)
return kerror;
if (strcmp(cred->service, service) ||
strcmp(cred->instance, sinstance) ||
strcmp(cred->realm, realm)) /* not what we asked for */
return INTK_ERR; /* we need a better code here XXX */
now = time(NULL);
if(krb_get_config_bool("kdc_timesync"))
krb_set_kdc_time_diff(cred->issue_date - now);
else if (abs((int)(now - cred->issue_date)) > CLOCK_SKEW)
return RD_AP_TIME; /* XXX should probably be better code */
return 0;
}
int
krb_get_in_tkt(char *user, char *instance, char *realm,
char *service, char *sinstance, int life,
key_proc_t key_proc, decrypt_proc_t decrypt_proc, void *arg)
{
KTEXT_ST as_rep;
CREDENTIALS cred;
int ret;
ret = krb_mk_as_req(user, instance, realm,
service, sinstance, life, &as_rep);
if(ret)
return ret;
ret = krb_decode_as_rep(user, instance, realm, service, sinstance,
key_proc, decrypt_proc, arg, &as_rep, &cred);
if(ret)
return ret;
return tf_setup(&cred, user, instance);
}
|
